[OR] [UBP] [E3] [CBS] [1] [SbPS] Identify Severe but Plausible Scenarios

Sub-CBS Code

Sub-CBS

Severe but Plausible Scenario

Impact / Effect

Proactive Risk Management Action

Link to Integration of Cyber and ICT Risks

1.1

Customer Onboarding and Account Application

Digital onboarding platform outage due to cloud service failure

Inability to onboard new customers; revenue loss

Implement multi-cloud redundancy and manual fallback onboarding

Cloud resilience, third-party ICT dependency

1.2

Customer Identification and Verification (KYC/CDD)

National ID verification API compromised or unavailable

Delayed onboarding; compliance breaches

Establish alternate verification channels and offline KYC procedures

API security, data integrity risk

1.3

Account Approval and Opening

Internal system misconfiguration is causing an approval backlog

Customer dissatisfaction; operational delays

Automated workflow monitoring and approval SLAs

Application control failures

1.4

Initial Funding and Deposit Booking

Payment gateway disruption is preventing initial deposits

Account activation delays

Integrate multiple payment gateways and reconciliation controls

Payment system dependency risk

1.5

Product Terms Setup and Account Parameter Maintenance

Erroneous system update altering product parameters

Financial misstatements; regulatory breaches

Change management controls and dual authorisation

Configuration management risk

1.6

Deposit Transactions Processing

Core banking system outage due to cyberattack (e.g., ransomware)

Transaction failure; customer impact at scale

Deploy a cyber resilience framework, backup systems, and DR drills

Cyberattack, ransomware, and system availability

1.7

Withdrawal and Funds Access Processing

ATM network failure or liquidity shortage

Customers are unable to access funds

ATM failover routing and liquidity monitoring

Network disruption, endpoint security

1.8

Account Servicing and Customer Maintenance

CRM system downtime due to database corruption

Delayed service requests; reputational damage

Database replication and integrity checks

Data corruption, database resilience

1.9

Interest, Fees, and Charges Processing

Batch processing failure due to a system bug

Incorrect charges; customer complaints

Pre-processing validation and reconciliation controls

Batch processing system risk

1.10

Statement, Passbook, and Balance Reporting

Data warehouse outage affecting reporting systems

Customers are unable to access account statements

Implement reporting system redundancy and backups

Data availability, analytics platform risk

1.11

Digital Account Access and Channel Integration

Mobile banking app compromised by malware attack

Unauthorized access; fraud losses

Strengthen mobile security, MFA, and fraud detection

Mobile app security, cyber threats

1.12

ATM and Card-Based Access Management

Card management system breach exposing card data

Fraudulent transactions; regulatory penalties

Tokenization and PCI-DSS compliance controls

Card data security, endpoint vulnerabilities

1.13

Account Reconciliation and Exception Handling

Reconciliation system failure leading to unmatched balances

Financial inaccuracies; audit issues

Automated reconciliation tools and exception escalation

Data processing and integrity risk

1.14

Dormancy, Holds, Restrictions, and Account Control Administration

Incorrect account restrictions due to a system error

Customer complaints; legal exposure

Rule validation and audit trail monitoring

Access control system risk

1.15

Fraud Monitoring and Transaction Surveillance

Fraud detection system outage during peak transactions

Undetected fraud; financial losses

AI-based fraud monitoring, redundancy, and escalation

Cyber fraud, real-time monitoring risk

1.16

Complaints, Disputes, and Service Recovery

Contact center outage due to telecom failure

Inability to handle customer complaints

Multi-channel support (chat, email, branch fallback)

Telecom dependency risk

1.17

Regulatory Reporting and Compliance Monitoring

Failure in the regulatory reporting system submission

Non-compliance penalties

Automated reporting validation and backup submission channels

Regulatory tech (RegTech) risk

1.18

Incident Response, Business Continuity, and Recovery

Disaster recovery site failure during a major outage

Prolonged service disruption

Regular DR testing and geographically separated recovery sites

DR infrastructure resilience